SQLite 3.41 implements a use‑after‑free flaw in the parsing of ORDER BY clauses. The parser frees an ExprList object and then mistakenly accesses its nExpr member, leading to a dangling pointer reference. This undefined behavior causes memory reads that can expose sensitive data and, under specific memory layouts, can trigger arbitrary code execution. The weakness is categorized as CWE‑416.

Any application embedding SQLite 3.41 and executing untrusted or user‑supplied SQL that contains an ORDER BY clause with a large number of items is vulnerable. The problem is tied to the parser code in expr.c of SQLite 3.41 and does not affect earlier or later builds unless they also retain the same code paths.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the entry is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote adversary sending a specially crafted SQL statement to the vulnerable application. The conditions for exploitation require a remote or local process that can control the SQL string, and while a denial of service is guaranteed, arbitrary code execution is only possible under particular memory‑layout conditions. Nonetheless, the availability of a remote trigger and the gravity of the outcome warrant immediate attention.